CVE-2022-38883

The d8s-math for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. The affected version is 0.1.0.
Configurations

Configuration 1 (hide)

cpe:2.3:a:d8s-math_project:d8s-math:0.1.0:*:*:*:*:python:*:*

History

21 Nov 2024, 07:17

Type Values Removed Values Added
References () https://github.com/democritus-project/d8s-math/issues/11 - Exploit, Issue Tracking, Third Party Advisory () https://github.com/democritus-project/d8s-math/issues/11 - Exploit, Issue Tracking, Third Party Advisory
References () https://pypi.org/project/d8s-math/ - Product () https://pypi.org/project/d8s-math/ - Product
References () https://pypi.org/project/democritus-strings/ - Product () https://pypi.org/project/democritus-strings/ - Product

Information

Published : 2022-09-19 16:15

Updated : 2024-11-21 07:17


NVD link : CVE-2022-38883

Mitre link : CVE-2022-38883

CVE.ORG link : CVE-2022-38883


JSON object : View

Products Affected

d8s-math_project

  • d8s-math
CWE
CWE-434

Unrestricted Upload of File with Dangerous Type